Technical Tip: GRE + IPSec not supported for NP7 offloading

NP7 offloading supports the GRE tunnel, including terminating on FortiGate or passing through FortiGate.NP7 offloading supports the IPSec VPN tunnel.

However, if the traffic is GRE + IPSec VPN, whether it is GRE passing through the IPSec VPN or GRE over IPSec, it is not supported for NP7 offloading.

The workaround is to configure 2 VDOMs, with IPSec terminated in 1 VDOM and GRE terminated in another VDOM.

For example:

• Root VDOM is used to establish VPN to the remote side.
• DMZ VDOM is used to establish GRE tunnel to remote side.

Related documents:

NP7 session fast path requirements

Tunneling protocols that can be offloaded by NP7 processors

Protocols that can be offloaded by NP7 processors